Ship auth and billing for your MCP server today. Not next week.

Building the MCP tool takes a weekend. Wiring identity and payments around it doesn't. This is a common story from builders shipping MCP servers in 2026:

— Real developer, r/mcp

• auth

  OAuth 2.1 + PKCE

  Your server accepts standard OAuth clients without you touching a single RFC.

• keys

  API key management

  Generate, rotate and revoke keys from the dashboard in one click.

• billing

  Stripe usage-based billing

  Charge per call, per token, whatever you want. Retries, partial failures and interrupted streams — explicit handling included, documented with code examples.

• limits

  Rate limiting with Redis

  Protect your server from abuse without writing a sliding window algorithm.

• multi

  Multi-tenant ready

  Each MCP server client gets its own context, keys and quota.

• infra

  Independent from your server

  Don't couple billing to your logic. It's infrastructure, not product code. Change your MCP server without touching billing.

Usage-based billing gets interesting once you have retries, partial failures, and streamed responses. These three decisions are already made for you.

• retry

  Retries never double-charge

  Every usage event carries an idempotencyKey. Same key twice, billed once.

  await recordUsage({ idempotencyKey: req.headers['idempotency-key'], endpoint: '/tools/search', status: 'completed', }) // same idempotencyKey again → 200 OK, not billed twice
• partial

  Partial failures aren't billed by default

  A call that dies mid-way is recorded with status: "partial", not sent to Stripe unless you say so.

  await recordUsage({ idempotencyKey, endpoint: '/tools/search', status: 'partial', // client disconnected mid-call }) // logged for audit — excluded from billing by default
• stream

  Streaming bills once, at the end

  One usage event per completed stream — not one per token.

  stream.on('end', () => recordUsage({ idempotencyKey, endpoint: '/tools/search', status: 'completed' }) ) // interrupted mid-stream → status: 'partial', same rule as above

How these decisions were made in practice — and where the only one still open is → full write-up on Dev.to

The idempotent metering pattern above — dedup by idempotency key, a commit boundary, partial/failed handling, a configurable billing policy — is also published separately as mcp-metering, a free, open-source (MIT) npm package. It's built for MCP servers that are already in production: drop it in as middleware around what you've already shipped, no rewrite required.

It does not include auth, OAuth, API keys, quota management, rate limiting, or Stripe integration — that's the full boilerplate below.

npm: mcp-metering · source on GitHub

Install it, read the code, and decide if the rest of the engineering is worth paying for. It's proof of quality, not a cut-down teaser.

Q: Do I need to understand OAuth 2.1 to use this?

A: No. Everything is pre-configured. Add your environment variables and deploy.

Q: What if Stripe changes its API?

A: The code is in your repository. You control the updates.

Q: Does it work with any MCP server or only certain frameworks?

A: It works as an independent layer. Your MCP server calls the auth and billing endpoints — framework agnostic.

Q: How does it handle retries and interrupted calls in billing?

A: Each usage event carries an idempotency_key. If the same event arrives twice (network retry), it's only charged once. Interrupted calls are recorded as 'partial' and you decide whether to charge them — documented with code examples.

Q: Is support included?

A: Yes — I respond to GitHub issues for 60 days from purchase. Built by Marc Gil · Dev.to

Q: Can I use it in client projects?

A: Yes. Unlimited use license. You cannot resell the boilerplate itself.

Q: Is there a refund policy?

A: Yes — 7-day refund if the code doesn't work in your environment and I can't fix it via GitHub issues. No questions asked within that window.

Q: Why not just ask Claude Code to build this?

A: You can — that's literally how this was built, with Claude Code as a pair programmer from day one. Writing the first draft was never the hard part. Early on, a webhook handler here returned the same 400 status for an invalid signature as for a transient database error — which meant Stripe never retried, and billing events could silently vanish. Catching that is the actual work: the code is cheap to generate now, the decisions and the tests that pin them down aren't. Check that level of detail yourself before paying: mcp-metering is free and open-source — install it, read it, judge for yourself.

Ready to ship?

Get MCP-Billing and have auth + billing running today.

One-time payment · No subscription · Commercial license